CVE-2026-85528 Snowflake JDBC Driver auto-configuration account validation permits credential redirection
Attackers can redirect login credentials to malicious hosts via improper account validation in Snowflake JDBC Driver, enabling credential theft and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-85528?
CVE-2026-85528 is a medium-severity server-side request forgery vulnerability in Snowflake JDBC Driver, published on 4 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to transmit a reusable login credential to a host of their choosing and replay it to obtain the privileges granted to that credential. Successful exploitation requires an application using jdbc:snowflake:auto with a connections.toml section that omits an explicit host and a lower-trust principal able to set the account value; ordinary JDBC URLs are unaffected. The fix is available in Snowflake JDBC Driver version 4.3.4, including the snowflake-jdbc-fips and snowflake-jdbc-thin. Users must manually upgrade.
Which versions are affected by CVE-2026-85528?
How do I fix CVE-2026-85528?
No fix has been published for CVE-2026-85528 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-85528 being exploited?
There is no known exploitation of CVE-2026-85528 in the wild and no public exploit code.
Sources
Also known as GHSA-cjvw-xm5r-xgpf.